Beamforming Feedback-based Model-Driven Angle of Departure Estimation Toward Legacy Support in WiFi Sensing: An Experimental Study

This study experimentally validated the possibility of angle of departure (AoD) estimation using multiple signal classification (MUSIC) with only WiFi control frames for beamforming feedback (BFF), defined in IEEE 802.11ac/ax. The examined BFF-based MUSIC is a model-driven algorithm, which does not require a pre-obtained database. This contrasts with most existing BFF-based sensing techniques, which are data-driven and require a pre-obtained database. Moreover, the BFF-based MUSIC affords an alternative AoD estimation method without access to channel state information (CSI). Specifically, the extensive experimental and numerical evaluations demonstrated that the BFF-based MUSIC successfully estimates the AoDs for multiple propagation paths. Moreover, the evaluations performed in this study revealed that the BFF-based MUSIC achieved a comparable error of AoD estimation to the CSI-based MUSIC, while BFF is a highly compressed version of CSI in IEEE 802.11ac/ax.


I. INTRODUCTION
WiFi sensing [1], [2] is envisioned as a technology that adds value to existing wireless local area networks beyond the communication infrastructure.In WiFi sensing, an example of widely used radio frequency (RF) information is channel state information (CSI), which is measured in multiple-input multiple-output orthogonal frequency-division multiplexing (MIMO-OFDM) systems [1].CSI is generally measured in the MIMO-OFDM communication procedures and includes a high sensing capacity to facilitate CSI-based sensing with low implementation cost and high sensing accuracy.
Presently, the next-generation WiFi standards task group, IEEE 802.11bf [3], is actively embedding WiFi sensing ability to WiFi standards.In IEEE 802.11bf [3], it is required to allow WiFi sensing with legacy devices (i.e., devices whose physical (PHY) layers are compliant with legacy WiFi standards, such as IEEE 802.11ac/ax [4], [5]).A challenge in meeting this requirement is that the legacy PHY layer processes and discards CSI, resulting in the disability of the CSI in WiFi sensing.
Beamforming feedback (BFF), which is a compressed version of CSI, has attracted attention as an alternative RF information to CSI, in order to address this challenge [6]- [12].Specifically, BFF includes a highly quantized right singular matrix of the CSI matrix for each subcarrier and subcarrier-averaged stream gain.In IEEE 802.11ac/ax [4], [5], a station (STA) transmits BFFs to an access point (AP) without any encryption, allowing an arbitral WiFi device to obtain the BFFs with medium access control (MAC)-level frame-capturing tools.Prior studies [6]- [13] have demonstrated the feasibility of BFF-based sensing in several sensing tasks, such as human localization and respiratory estimation.
However, the existing BFF-based sensing literature has lacked the following perspectives, model-driven sensing and comparison of CSI to BFF in terms of sensing accuracy.First, to the best of the authors' knowledge, in the BFF-based sensing literature, there are no model-driven algorithms, which geometrically estimate the surrounding environment based on mathematical modeling, although a vast of CSI-based model-driven algorithms [14], [15] have been proposed.In contrast, the existing BFF-based sensing methods [6]- [11] are referred to as data-driven methods; namely, the sensing tasks are conducted via pattern matching to a pre-obtained training dataset, which comprises the BFF and corresponding actual-measured target labels (e.g., human locations or device locations).Because such training dataset generation procedure incurs tremendous human costs, the cost of datadriven sensing is generally higher than that of model-driven sensing.Therefore, the lack of model-driven methods in the BFF-based sensing literature results in significant drawbacks to CSI-based sensing.
This motivated the development of a BFF-based modeldriven sensing algorithm that does not require preparing the dataset.To this end, we revisit model-based sensing in the CSI-based sensing literature.A fundamental technique referred to as the multiple signal classification (MUSIC) algorithm [16] is used to estimate the angle of departure (AoD) for each of the multiple propagation paths.Based on the original MUSIC algorithm [16], which imposes some constraints, there have been various extensions to CSI-based sensing, for example, the alleviation of constraints regarding antenna array [17] and propagation environment [14], and the realization of addressing-sensing tasks [18].These studies constructed high-capacity and widely applicable sensing frameworks.However, whether the original MUSIC algorithm applies to BFF-based sensing remains unknown.
This paper presents model-driven analytics of BFF-based sensing and demonstrates that an extension of the MUSIC algorithm [16] can be realized using BFF.Specifically, given the Λ and V  as the subcarrier-averaged stream gain and right singular matrix of CSI matrix at the th subcarrier, the noise subspace vectors in the MUSIC algorithm are estimated as the eigenvectors of a covariance matrix  V  ΛV H  with an eigenvalue of zero.In contrast, CSI-based MUSIC generally uses a covariance matrix  h  H h  , where h  is a row vector of the CSI matrix.The mathematical analytics revealed that the role of the covariance matrix obtained from BFF has the same role as the covariance matrix obtained from CSI.Our numerical evaluation and extensive experimental evaluations indicated that the BFF-based MUSIC algorithm accurately estimates AoDs and is comparable to the CSIbased MUSIC.
Second, to the best of the authors' knowledge, the existing BFF-based sensing approach has not provided a sensingaccuracy comparison between CSI and BFF.Instead of the benefit of usability of BFF, because the BFF is a highly compressed version of CSI, the sensing accuracy of the BFF is, in principle, lower than that of CSI.Thus, the experimental comparisons of CSI and BFF are essential to assess the feasibility of replacing CSI with BFF.We compared the AoD estimation accuracy of BFF-and CSI-based sensing and revealed that the BFF-based sensing achieves comparable accuracy to the CSI-based sensing.Specifically, in three experimental environments, the median AoD estimation accuracy difference between BFF-based MUSIC and CSI-based MUSIC is smaller than 0.1°.
The contributions of this study are summarized as follows: • We analytically confirmed that the MUSIC algorithm can be performed using only the BFF frame.Specifically, using Λ and V  , which are contained in the BFF frame, the noise subspace vectors in the MUSIC algorithm are estimated as the eigenvectors of  V  ΛV H  with an eigenvalue of zero.This finding shows that the AoD estimation only using BFF is possible, shedding light on the applicability of model-driven BFF-based sensing to various sensing tasks (e.g., human sensing and device localization).• We demonstrated the feasibility of model-driven BFFbased sensing as an alternative method without requiring access to CSI.More specifically, a numerical evaluation and extensive experimental evaluations reveal that, while the BFF procedure defined in IEEE 802.11ac/ax quantizes V  and Λ (e.g., 3 × 2 complex matrix is represented by only 30 bit), the AoD estimation accuracy of BFF-based MUSIC is comparable to that of CSIbased MUSIC.This is the first work that compares BFFbased sensing and CSI-based sensing in terms of sensing accuracy in the same experimental environment.This study focused on the feasibility of the original MU-SIC algorithm using BFF and the assessment of the accuracy degradation of BFF from CSI.Thus, the comparison and implementation of more sophisticated CSI-based sensing methods such as [14] and data-driven BFF-based sensing methods are out of the scope of this study.

A. NOTATIONS
We denote the transpose of a matrix H as H T , its conjugate as H * , its Hermitian transpose as H H , and the (, ) element as  ,  .We denote the th element of a vector a as   and the Euclidian norm as |a|.The identity matrix is represented as E. The diagonal matrix, whose th diagonal element is   , is represented as diag(a).The  ×  zero matrix is denoted as 0  × .

B. RELATED WORKS AND PRELIMINARY 1) Related Works
Here, we provide a brief review of existing WiFi sensing literature, detailing the difference from such studies.
CSI-based sensing.Due to the rich sensing capacity of CSI, CSI has been attracted for providing RF information for WiFi sensing [1], [2].There are various CSI-based sensing methods, including model-driven methods [1], [2], [14], [15], [19] and data-driven methods [1], [2], [20].While the datadriven methods require a considerable cost to collect training datasets, model-driven methods are conducted without any A basic theorem of the model-driven methods is the MUSIC algorithm [14]- [16], which is detailed in Section I-B4.Based on the MUSIC algorithm, various extended versions [14], [17], [18] are proposed.However, devices whose firmware is compliant with legacy WiFi standards (e.g., IEEE 802.11ac/ax) cannot conduct CSI-based sensing without remodeling their firmware.This is because CSI is processed and discarded in the PHY layer at the legacy WiFi standards.Thus, a remodeled firmware (e.g., [21]- [23]) is required to conduct CSI-based sensing.Moreover, few wireless chips permit access to the PHY layer from the remodeled firmwares [21]- [23].In contrast with CSI-based sensing, BFF-based sensing, which can be performed using arbitral devices compliant with the IEEE 802.11ac/ax, is the focus herein.
BFF-based sensing.Table 1 summarizes the existing BFF-based sensing studies.As mentioned in the previous section, because BFFs can be collected via the MAClayer frame capturing without any constraints regarding the firmware, BFF sensing has the potential as an alternative to CSI in WiFi sensing with legacy devices.There are few studies on BFF-based sensing, for instance, those concerning human detection [6]- [8], [12], [13], device localization [11], respiratory rate estimation [9], and camera image estimation [10].Most of the studies [6]- [8], [10]- [13] are categorized as data-driven methods.Only [9] is categorized into model-driven methods.[9] estimates the respiratory rate of a human by focusing on the relationship between the temporal variations of the BFF and respiratory rate.However, [9] is a heuristic and does not provide any propagation modelbased analytics.In contrast with these studies, the present study is based on a well-known propagation model [24] and analytically confirmed that the AoD is estimated using the BFF via MUSIC algorithm.
Moreover, this is the first work that presents accuracy comparisons between CSI and BFF.Prior studies [6]- [13] have only provided the accuracy of BFF-based sensing and have not included comparisons between CSI-and BFF-based sensing.Because the BFF includes significant quantization losses, the accuracy of the BFF-based sensing is principally inferior to that of the CSI-based sensing.Thus, evaluating the degree of accuracy degradation is essential to assess whether BFF can be an alternative to CSI.Our extensive experimental evaluations revealed that BFF-based MUSIC achieves a comparable median of AoD estimation accuracy to CSI-based MUSIC.
2) Beamforming Feedback Scheme in 802.11ac/ax We consider a MIMO communication system in which a transmitter (e.g., AP) transmits signals to a receiver (e.g., STA).We denote the CSI matrix from the transmitter to the receiver at the th subcarrier as H  ∈ C  × , where  and  denote the number of antenna elements of the receiver and transmitter, respectively.In IEEE 802.11ac/ax standards, to provide efficient eigen beam-space division multiplexing [25], the receiver feedbacks the BFF frame to the transmitter [4], [5], which contains a compressed version of the CSI matrix.Because the BFF frame is exchanged over the air without encryption, BFFs can be obtained using the MAC frame-capturing tools, thus enabling an arbitral sniffer to perform BFF-based WiFi sensing without requiring access to the PHY layer components of the transmitter and receiver [7].
The BFF contains highly quantized right singular matrix V  of the CSI matrix H  for each subcarrier and a subcarrieraveraged stream gain [4], [5].The right singular vector V  is calculated using singular value decomposition as where U  and V  are unitary matrices, and Σ  is a diagonal matrix with singular values [26].Denoting number of subcarriers as , the subcarrier-averaged stream gain is represented by a diagonal matrix Λ, where Notably, the diagonal elements of Σ  are generally real and positive and are listed in descending order.As per IEEE 802.11ac/ax [4], [5] standards, the V  and Λ are highly quantized to reduce the payload size of the BFF frame.Specifically, V  is converted to the  angle angles without any quantization losses using Givens rotation, where  angle is determined by  and .The  angle angles are quantized with a predefined quantization step size Δ and contained in a BFF frame.The IEEE 802.11ac [5] defines four quantization step sizes, namely /4 rad, /8 rad, /16 rad, and /32 rad.The subcarrier-averaged stream gain Λ are quantized with quantize step sizes of 0.25 dB [5].

3) Propagation Model
We consider a discrete physical propagation model [24], wherein a uniform linear array is employed at the transmitter VOLUME 4, 2016 and receiver.In the following description, for simplicity, we assume that the distances between consecutive antennas at the transmitter and receiver are the same, which is denoted as . 1  Let  be the number of propagation paths.Additionally, let   be the AoD and   be the angle of arrival of the th path.The complex scalar   denotes the attenuation from the transmitter's first antenna to the receiver's first antenna by the signal traveling along the th propagation path.We denote a complex phase shift () as exp(2 sin()/), where  is the wavelength.For shorthand notation, let -dimensional vectors θ, φ, and r represent ( 1 , . . .,   ) T , ( 1 , . . .,   ) T , and ( 1 , . . .,   ) T , respectively.Additionally, we denote the steering vector a() (1, (), . . ., ()  −1 ) T ;  ×  steering matrix A(θ) (a( 1 ), . . ., a(  )) T ; and  ×  diagonal matrix R diag(r).In the discrete physical propagation model [24], the CSI matrix H is represented as (3)

4) Multiple Signal Classification (MUSIC) Algorithm
The CSI-based MUSIC algorithm [15] estimates multiple AoDs from CSI by assuming  < .The general CSI-based MUSIC consists of three steps as follows [14]- [16].First, given an arbitral slim and full-rank matrix as S, we estimate a matrix X represented by SA(φ) H .For example, in [14], [16], the matrix X 0 is a  ×  matrix, whose th row vector is the first row vector of the CSI matrix at the th subcarrier.
Considering the propagation model denoted in (3), the first row vector of the CSI matrix at the th subcarrier is represented by Given  ×  matrix S 0 as (r 1 , . . ., r  ) T , the matrix X 0 is represented by Generally, S 0 is slim and full-rank [15], [16]; thus, X 0 is represented as a product of the slim and full-rank matrix and A(φ) H . Second, a covariance matrix C X H X is obtained, and the − noise subspace vectors e 1 , . . ., e  − are calculated as the  −  eigenvectors of C with small eigenvalues.Lastly, the AoDs are estimated as angles that achieve peaks of MUSIC spectrum (), where where E N = (e 1 , . . ., e  − ). 1 This assumption can be easily expanded to the case that the distances between consecutive antennas differs between the transmitter and receiver.

II. BEAMFORMING FEEDBACK-BASED MULTIPLE SIGNAL CLASSIFICATION
Fig. 1 shows the system model consisting of an STA, an AP, and a sniffer.The STA receives the sounding frame (e.g., the null data packet in IEEE 802.11ac/ax [4], [5]) from the AP, estimates the CSI, and calculates the BFF from the CSI, which is detailed in Section I-B2.Then, the STA transmits the BFF to the AP without any encryption.The sniffer captures the BFF transmitted from the STA, decodes the BFF, and obtains the right singular matrix V  for each subcarrier and subcarrier-averaged stream gain Λ.Subsequently, the sniffer estimates the AoDs of the AP using the BFF-based MUSIC method, which is detailed in the following sections.This study confirmed that the MUSIC algorithm is applicable using only the BFF to estimate multiple AoDs, which is proved in Proposition 1. Specifically, assuming that Λ = Σ  2 for all , the covariance matrix used in the MUSIC algorithm is estimated as Based on the covariance matrix2 , the AoDs are estimated by the general MUSIC algorithm, which is detailed in Section I-B4.
Proposition 1.Given a slim and full-rank matrix S and assuming Λ = Σ 2  , the covariance matrix C defined in ( 8) is denoted by a covariance matrix of SA(φ) H .
Proof.Using the aforementioned assumptions, C in ( 8) is expressed as Substituting ( 1) and ( 3) to C, we obtain Using Thus, this proposition essentially proves that S is fullrank.Based on the deduction that S 0 is slim and full-rank, which is denoted in Section I-B4, the above proposition is proved by indirect proof.We denote a diagonal matrix Â(θ) as diag(( 1 ), . . ., (  )).If S is not a full-rank matrix, a non-zero vector x ∈ C  satisfies The equation ( 12) is equivalent to that, for all  = 1, . . ., , x satisfies However, as denoted in [14], S 0 is generally slim and fullrank, and Â(θ) −1 is regular; thus, this shows a contradiction.

A. DETAIL PROCEDURE
The detailed procedure of the BFF-based MUSIC algorithm is presented in Algorithm 1.The STA estimates the CSI using a sounding frame transmitted from the AP, calculates the BFF from the CSI, and transmits the BFF to the AP.We denote H , as the CSI matrix at the th subcarrier from the th sounding frame.We also denote the right singular matrix and subcarrier-averaged stream gain of H , as V , and Λ , respectively.The BFF corresponding to the th sounding frame includes V 1, , . . ., V  , and Λ .The Λ and V , include quantization errors because the BFF frame is highly quantized in IEEE 802.11ac/ax [4], [5], which is detailed in Section I-B2.The frame capture obtains  pct BFF frames transmitted from the STA and estimates multiple AoDs of the AP from the BFF frames.For each captured BFF frame, the frame capture obtains subcarrier-averaged stream gain Λ and the right singular matrix V , .Using Λ and V , , the covariance matrix C  is calculated as where W  is a diagonal matrix that compensates for the phase sift introduced at the AP.The methods to estimate W  are detailed in Section II-B.We average C  among  pct 9: Obtain AoDs as  peaks of MUSIC spectrum.
packets and use the averaged covariance matrix C ave in the following MUSIC procedure, where Following the existing CSI-based MUSIC methods [15], [27], we adopt spatial smoothing to C ave .We denote the spatial smoothing function as  smt and the smoothed covariance matrix as C smt , where C smt =  smt (C ave ).The spatial smoothing procedure is detailed in Section II-C.From the smoothed covariance matrix C smt , we estimate AoDs using the general MUSIC algorithm [16], as described in Section I-B4.Notably, the estimation of the number of the propagation paths  is required in the BFF-based MUSIC algorithm as with the CSI-based MUSIC algorithm.In this work, we assume that  is given, and the number of path estimation problems is out-of-scope.This is because the problem is not specific to BFF-based sensing.

B. CALIBRATION PROCEDURE
To provide accurate AoD estimation, the compensation for the phase offset introduced at the AP is required [15].To this end, we implemented calibration method that estimates the phase shift difference between the antenna elements.The calibration procedure measures the BFF at the environment where the number of propagation paths is only one and the AoD is given; subsequently, the phase offset at the AP is estimated.Specifically, the calibration procedure is as follows: the covariance matrix of the CSI matrix is estimated from the BFF; and the eigenvector of the covariance matrix with the largest eigenvalue corresponds to the phase shift of the AP.
Formally, we denote the phase offset introduced at the th antenna of the AP to be e j , .The calibration procedure estimates e j(  , − 1, ) .For shorthand notation, we denote a diagonal matrix W  as diag 1, e j(  2, − 1, ) , . . ., e j(   , − 1, ) .Considering the  × 1 MIMO system, and given that  = 1 VOLUME 4, 2016 and the pre-obtained AoD is φ, the observed CSI matrix is denoted as where   denotes the complex path gain.The calibration procedure estimates W  using the preobtained AoD φ and BFF calculated from H obs  as follows.We denote the right singular matrix and subcarrier-averaged stream gain of H obs  as V obs

𝑘
and Λobs , respectively.First, the covariance matrix of H obs  is estimated as V obs  Λobs (V obs  ) H .The covariance matrix is also represented by From ( 17), the covariance matrix has  − 1 eigenvectors with an eigenvalue of zero and an eigenvector with an eigenvalue of |  | 2 , and the latter eigenvector is W  H a( φ) H . Thus, denoting the latter eigenvector as x (1,  2 , . . .,   ) T , W  is estimated as In the MUSIC algorithm, which is implemented after the calibration, W  V  is used instead of V  .

C. SPATIAL SMOOTHING
As denoted in [15], [27], when the multipath signals are phase-synchronized with each other, the distinct multipath signals are recognized as one superposed signal, resulting in false peaks in the MUSIC spectrum.To address the problem, we adopt spatial smoothing [15], [27], which splits the AP's antenna array into multiple sub-antenna arrays.Given that  antennas are integrated into a sub-antenna array, the antenna array with  antennas are considered  −  + 1 sub-antenna arrays.The covariance matrix is calculated for each sub-antenna array in the spatial smoothing procedure, and the covariance matrices are averaged.Specifically, given the covariance matrix for the th sub-antenna array as C sub  ∈ C  × , C sub  is a submatrix of C, where 1, . . .,  − 1,  +  , . . .,  rows and columns are removed from C. The averaged covariance matrix C smt ∈ C  × is obtained as The averaged covariance matrix C smt is used for estimating the noise subspace vectors, instead of the original covariance matrix C.

III. NUMERICAL EVALUATION
Because the ground-truth multiple AoDs generally cannot be measured in a real-world environment, we examined the capacity of the BFF-based MUSIC to estimate multiple AoDs using a numerical evaluation.Moreover, in the extensive experimental evaluations in real-world environments provided in Section IV, we evaluated the accuracy of the AoD estimation, assuming that only the direct path exists.The AP and STA are equipped with uniform array antennas.Each of the antenna arrays contains four antenna elements that are parallel to the x-axis.We assume free-space propagation, wherein the indirect paths are decayed by 0.3 of the amplitude, and ignore the effect of the reflection more than once.The CSI estimation is emulated by adding Gaussian noise to ground-truth CSI matrix H  .Specifically, the estimated CSI at the th subcarrier is denoted as where N is an  ×  complex matrix whose real and imaginary parts of the elements follow a Gaussian distribution with mean 0 and variance  2 /2.It should be noted that  2 is the noise power at each antenna element.We calculate H obs  for each subcarrier  and then obtain the V  for each subcarrier and subcarrier-averaged stream gain Λ, by following the procedure denoted in Section I-B2.Specifically, we select the quantization step size Δ of /32 rad for the quantization of V  ,3 resulting in the 4 × 4 right singular matrix V  being represented by only 60 bit.Additionally, as defined in the IEEE 802.11ac [5], the subcarrier-averaged stream gain Λ are quantized with a quantization step size of 0.25 dB.
Moreover, to assess the error of multiple AoD estimations, we swap the order of the estimated AoDs to minimize the error between the estimated AoDs and groundtruth AoDs; subsequently, the error is calculated from the swapped versions of the estimated and ground-truth AoDs.The detailed parameters are as follows: the distance of each antenna element is 25 mm, the number of subcarriers is 52, the bandwidth is 20 MHz, the center frequency is 5.18 GHz, the number of CSIs used for each AoD estimation  pct is ten, and the number of antenna elements in each sub-antenna array  is two.stimated AoDs of the BFF-based MUSIC match with the ground-truth AoDs, as well as that of the CSI-based MUSIC.
Table 2 shows the median of the absolute error of the AoD estimation by the CSI-and BFF-based MUSIC for each SNR.Regardless of the SNR, the error of the CSIbased MUSIC is lower than or equivalent to that of the BFFbased MUSIC.This is because the BFF is highly quantized; specifically, the 4 × 4 right singular matrix is represented by only 60 bit.However, the difference in the error between the two sensing methods is trivial.Specifically, to estimate the AoDs of the direct and indirect paths, the difference is smaller than 0.03°and 0.4°, respectively.Thus, we can conclude that the BFF-based MUSIC accurately estimates multiple AoDs; moreover, the accuracy of the BFF-based MUSIC is comparable to that of the CSI-based MUSIC.If the BFF is not quantized, the result of the AoD estimation from the CSI and BFF matches perfectly.

IV. EXPERIMENTAL EVALUATION
This study evaluated the accuracy of BFF-and CSI-based MUSIC algorithms in various real-world environments, where the line-of-sight (LoS) path between the AP and STA exists.Notably, this evaluation is based on the assumption that the number of propagation paths is one (i.e., only the  direct path exists), and the ground-true AoD is defined as the AoD of the LoS path.This assumption was adopted because we cannot measure the ground-truth AoDs of the reflection paths in the real-world environment.
Experimental evaluations were performed in three realworld scenarios: indoor, outdoor, and semi-outdoor scenarios.The indoor, outdoor, and semi-outdoor scenarios differ in terms of the effect of the reflection paths.Specifically, the received power caused by the reflection paths in the indoor scenario is generally larger than the outdoor and semioutdoor scenarios.The outdoor and semi-outdoor scenarios differ in terms of the method to vary AoD.In the outdoor scenario, the position and orientation of the antenna array of the AP are fixed, and the AoD only depends on the position of the STA.However, in the semi-outdoor scenario, the AP and STA are fixed, and the AoD only depends on the orientation of the AP's antenna array.

A. SETUP
Experimental equipment: The experimental system consists of an AP and STA equipped with three and two antennas, resulting in the 2 × 3 CSI matrix.As shown in Fig. 4, the antenna elements of the AP are linearly aligned, where the distance of the conservative antenna elements is 25 mm.The communication protocol, the wireless channel, the bandwidth, and the number of subcarriers are IEEE 802.11ac, 104ch, 20 MHz, and 52, respectively.Moreover, ASUS RT-AC86U is used for the AP and STA.The detailed parameters of the MUSIC algorithm are as follows: the number of CSIs or BFFs used for each AoD estimation  pct is ten, and the number of antenna elements in each sub-antenna array  is two.BFF estimation: Notably, to provide fair comparisons between CSI-and BFF-based sensing, we used a firmware modification [21] to extract CSI from the AP and calculate BFF from the extracted CSI.Specifically, assuming the chan-  nel reciprocity, we emulated the CSI measured at the STA as the transpose of the CSI measured at the AP.From the CSI, the corresponding BFF is calculated following the IEEE 802.11ac standard as described in Section I-B2.
Because the shape of CSI is 2 × 3, the right singular matrix V  is represented by 12 angles with the quantization step size Δ.Unless otherwise noted, this evaluation used Δ of /32 rad, resulting in a 2 × 3 complex matrix V  H represented by 30 bits. 3 .Additionally, as defined in the IEEE 802.11ac [5], the subcarrier-averaged stream gain Λ were quantized with a quantization width of 0.25 dB.Experimental scenario: The experimental evaluation was performed on three scenarios: outdoor, semi-outdoor, and indoor scenarios.An LoS path exists between the AP and STA in the three scenarios.For all the scenarios, the CSIs and corresponding BFFs were obtained at multiple arrangements regarding the AP and STA, where the ground-truth AoD differs by the arrangement.Regardless of the scenario, the AP captures approximately 850 packets from the STA at each equipment arrangement and estimates CSI and BFF for each captured packet.Fig. 5 shows the setup and snapshot of the outdoor scenario.The STA is placed at either of the nine positions on the circle with a radius of 2.0 m centered on the AP.The    where the LoS exists through the open windows.In the semioutdoor environment, the orientation of the antenna array of the AP is changed, whereas the orientation of the antenna array of the STA is fixed parallel to the y-axis.Thus, the AoD only depends on the orientation of the AP's antenna array.Specifically, the orientation of the AP is changed so that the AoD is either of −60°to 60°in 15°increments.Figs.7 shows the indoor experimental scenario and its snapshot.The two APs and STA are located in a lecture room, where the orientation of the antenna array of the APs and STA is fixed parallel to the y-axis.While the APs are fixed, the STA is located at either of ten positions on a line parallel to the x-axis, where the distance between the line and AP is 2.4 m.Thus, the AoD only depends on the STA's position.In the scenario, the AoD is varied from approximately −60°to 60°.It should be noted that the AoD estimation is conducted for each AP.Calibration procedure: Fig. 8 shows the setup of the calibration procedure.The AP's antennas and a transmitter antenna are connected via coaxial cables.Because the length of the coaxial cables between the antenna of the AP and the transmitter are the same among the three antennas of the AP, the phase of the AP's antennas are considered to be the same and there exists only a direct wave (i.e.,  = 1 and φ = 0).We captured approximately 1,000 packets in the environment, obtained CSIs, and calculated BFFs.From the BFFs, we estimated the calibration matrix W as detailed in Section II-B.

B. RESULTS
Results of calibration procedure: Fig. 9 shows the angle of the estimated calibration matrix W  from the BFF with a quantization step size of /32 rad and /4 rad, and CSI, respectively.As denoted in Section II-B, the calibration matrix W  is denoted as diag(1,  ,2 ,  ,3 ).Thus, Fig. 9 depicts the argument of  ,2 and  ,3 , respectively.When the quantization step size is /32 rad, the estimated arguments from the BFF match that of the CSI; Specifically, the difference between the arguments estimated from the BFF and CSI is smaller than 2.3°regardless of the subcarrier index.Thus, we can conclude that when the quantization step size is small, the  As the quantization step size is increased, the difference in the estimated arguments between the BFF and CSI increases because of the quantization error induced in the BFF.Specifically, when the quantization step size is /4 rad, the median and maximum difference between the estimated arguments from the BFF and that from CSI is 15.4°and 25.0°, respectively.However, the following evaluations reveal that, even when the quantization step size is large, the BFF-based MUSIC achieved comparable AoD estimation accuracy to the CSI-based method.
AoD estimation error comparison: Fig. 10 shows the empirical cumulative distribution function (CDF) of the AoD estimation error using BFF-and CSI-based MUSIC, respectively.In Fig. 10, the error of the BFF-based MUSIC is comparable to that of the CSI-based MUSIC regardless of the experimental scenarios.Table 3 lists the error medians of the AoD estimation by CSI-based MUSIC and BFFbased MUSIC in the three scenarios.As shown in Fig. 10, regardless of the scenario, the errors of the BFF-and CSIbased MUSIC are comparable.Thus, the BFF-based MUSIC achieves comparable AoD estimation accuracy to CSI-based MUSIC, although the BFF is highly quantized, specifically, the 2 × 3 right singular matrix is represented by only 30 bit, and the subcarrier-averaged stream gain are represented with a quantization step size of 0.25 dB.
Additionally, the error of the CSI-based MUSIC in this evaluation is comparable to the previously reported value [19], that is approximately 10°.Although the error of     the AoD estimation highly depends on the experimental environments and equipment (e.g., the antenna characteristics, the propagation environment, and the placement of the AP and STA), the similarity of the error between this paper and the existing report [19] indicates that the implementation in this study is adequate.
Upon comparing the estimation errors between the scenarios, the errors of the indoor scenarios are found to be higher than those of the outdoor and semi-outdoor scenarios for both the CSI-and BFF-based MUSIC.This is because the number of propagation paths at the indoor scenario is larger than that at the outdoor and semi-outdoor scenarios.Because we assumed  = 1 in this experimental evaluation, the larger multipath degrades the AoD estimation accuracy.
Impact of quantization step size: Fig 11 shows the impact of the quantization step size on the AoD estimation error of the BFF-based MUSIC.In IEEE 802.11ac [5], four quantization step sizes Δ of V  are defined, namely /4 rad, /8 rad, /16 rad, and /32 rad.Regardless of the experimental scenarios, the impact of the quantization step size on the median of error is less than 3.0°.Moreover, regardless of the experimental scenarios and the quantization step size, the BFF-based MUSIC achieved a comparable AoD estimation error to the CSI-based methods.Thus, even when the AP adopts the largest quantization step size defined in IEEE 802.11ac, the BFF-based MUSIC achieves comparable AoD estimation accuracy to CSI-based MUSIC.

V. CONCLUSION
This study confirmed that, to estimate multiple AoDs, an extension of the MUSIC algorithm is applicable using BFF, which contains only subcarrier-averaged stream gain and the

FIGURE 1 :
FIGURE 1: System model of BFF-based MUSIC.STA transmits BFF to AP without any encryption, allowing the sniffer to capture the BFF and conduct BFF-based sensing.

Fig. 2
Fig.2illustrates the system, which comprises an AP, an STA, and a reflection point, resulting in two different propagation paths between an antenna element of the AP and that of the STA-a direct path and an indirect path caused by the reflection point.The STA and reflection point exist at (0 m, 10 m) and (5.5 m, 3 m), respectively, whereas the AP exists at either of 11 points on the x-axis.Specifically, the  a th AP's position is denoted by ( a − 5 m, 0 m), where 0 ≤  a ≤ 10.The AP and STA are equipped with uniform array antennas.Each of the antenna arrays contains four antenna elements that are parallel to the x-axis.We assume free-space propagation, wherein the indirect paths are decayed by 0.3 of the amplitude, and ignore the effect of the reflection more than once.The CSI estimation is emulated by adding Gaussian noise to ground-truth CSI matrix H  .Specifically, the estimated CSI at the th subcarrier is denoted as

Fig. 3 FIGURE 2 :
Fig.3shows an example of the MUSIC spectrum function () of the BFF-and CSI-based MUSIC algorithms, respectively.The results denoted in Fig.3are obtained with the setting that the signal-to-noise ratio (SNR) is 20 dB, and the AP exists at (−3 m, 0 m), which is the AP position surrounded by the red square in Fig.2.The two peaks of the MUSIC spectrum function indicate the two estimated AoDs.The

FIGURE 3 :
FIGURE 3: MUSIC spectrum function of BFF-and CSIbased MUSIC obtained in numerical evaluation.The two peaks of the function indicate the two estimated AoDs.

FIGURE 4 :
FIGURE 4: Snapshot of AP.Three antennas are linearly aligned with 25 mm of the space between antennas.

FIGURE 5 :
FIGURE 5: Outdoor experimental scenario.STA is placed at either of the nine red points.AP and STA are located at a height of 0.9 m.

FIGURE 6 :
FIGURE 6: Semi-outdoor experimental scenario.AP and STA are located in different rooms on the fourth floor, where the LoS path exists through open windows.The height of AP and STA from the floor is 0.9 m, and that of the rooms is 3.0 m.

FIGURE 7 :
FIGURE 7: Indoor experimental scenario.STA is placed at either of the ten red points, whereas two APs are located at the blue points.The height of AP and STA are 0.9 m.The height, width, and depth of the room are 3.0 m, 7.5 m, and 18.6 m, respectively.

FIGURE 8 :
FIGURE 8: Setup of calibration procedure.The lengths of the coaxial cables are adjusted so that the phases at the three antennas of the AP are the same.
MUSIC BFF-based MUSIC (b) Semi-outdoor scenario.

FIGURE 10 :
FIGURE 10: Empirical CDF of absolute error of AoD estimation by CSI-based MUSIC and BFF-based MUSIC for each scenarios.
error (degree) CSI-based in outdoor BFF-based in outdoor CSI-based in semi-outdoor BFF-based in semi-outdoor (a) Outdoor and semi-outdoor scenario.error (degree) CSI-based w.AP1 BFF-based w.AP1 CSI-based w.AP2 BFF-based w.AP2 (b) Indoor scenario.

FIGURE 11 :
FIGURE 11: Impact of quantization step size on median error of AoD estimation for each scenario.

TABLE 1 :
Summary of BFF-based WiFi sensing.

TABLE 2 :
Median of absolute error of AoD estimation by CSI-and BFF-based MUSIC for each SNR.

TABLE 3 :
Median of absolute error of AoD estimation by CSI-and BFF-based MUSIC for each scenario.